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Abstract 



We show how an algorithm for the problem of inverting a permutation may be used to design one for 
the problem of unordered search (with a unique solution). Since there is a straightforward reduction in 
the reverse direction, the problems are essentially equivalent. 

The reduction we present helps us bypass the hybrid argument due to Bennett, Bernstein, Brassard, 
(-H , and Vazirani (1997) and the quantum adversary method due to Ambainis (2002) that were earlier used 

Oj' to derive lower bounds on the quantum query complexity of the problem of inverting permutations. It 

directly implies that the quantum query complexity of the problem is asymptotically the same as that 
" ^ , for unordered search, namely in Q{^/n). 

C^ 

O^. 1 Introduction 

-Y-\ , Let n be a positive integer. The problem Permutation„ of inverting a permutation tt on the set [n] = 

^ ■ {1,2, ... ,n} is defined as follows. Given tt in the form of an oracle, and n as input, output "yes" if the 

0> I pre-image 7r^^(l) is even and "no" if it is odd. This is a natural decision version of the problem that asks 

On ■ us to find 7r^^(l). A related problem is that of unordered search: Given a function / : [n] — > {0, 1} as an 

5~, i oracle, and n as input, output "yes" if /^^(l) is non-empty and "no" otherwise. In other words, determine 

if / maps any element i G [n] to 1. In this article, we restrict ourselves to functions / which map at most 

r^ I one element to 1. As we might expect, these constitute the hardest instances of unordered search. We refer 

to the corresponding sub-problem as Unique Search„. 

The two problems were originally used by Bennett, Brassard, Bernstein, and Vazirani [2] to show limi- 
tations of quantum computers. The search problem Unique Search was used to show that relative to a 
random boolean oracle A, with probability 1, NP % BQP . The inversion problem Permutation was 
^^ ■ similarly used to show that relative to a random permutation oracle A, with probability 1, NP Hco-NP % 

H ' BQP . For the first result, Bennett et al. showed that any quantum algorithm for Unique Search„ re- 



quires fl{y^) queries for a constant probability of error. This involved a hybrid argument that works for 
both worst-case error and distributional error under an equal mixture of uniform distributions over "yes" and 
"no" instances. The lower bound is matched by the Grover quantum search algorithm [3], and is therefore 
optimal. For the second result, Bennett et al. used a nested hybrid argument and showed that any quantum 
algorithm for the inversion problem requires fl{y^) queries (for constant probability of error under the 
uniform distribution). The optimal bound of fl{^/n) was established for worst-case query complexity by 
Ambainis [1 using the then-newly-minted quantum adversary method. 

An algorithm for unordered search (in fact, for Unique Search„) may be used to solve the inversion 
problem Permutation„ in the obvious manner, using at most twice the number of oracle queries. Namely, 
we define a boolean function / on [n] such that f{i) = 1 iff 7r(z) = 1 and i is even. This function may 
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be evaluated with one classical query to an oracle for tt. An additional query is used in the quantum case 
to "erase" the answer to the first query (see the discussion regarding quantum queries at the end of the 
proof of Theorem I2.1l in Section [5]). Therefore the Grover quantum search algorithm 3: solves this problem 
with 0{y/n) queries to an oracle for tt. We describe a reduction in the reverse direction, i.e., we show 
how any algorithm that solves Permutation„ may be modified to solve Unique Search„/2 when n is 
even. The intuition behind the reduction comes from a hybrid argument in which we consider runs of the 
algorithm on oracles not in its domain. This kind of device has been used in numerous works on quantum 
query complexity to great effect. 

The reduction we present is randomized and is between distributional versions of the problems, with 
equal weight on "yes" and "no" instances, and with uniform conditional distributions for each kind of 
instance. Due to the inherent symmetry in the two problems under consideration, the distributional and 
worst-case versions of the problems are, in fact, equivalent in query complexity (for the distributions described 
above; see Lemma 12.21 and the discussion following it). Thus, we are also able to derive an algorithm 
for Unique Search„/2 with a bound on its worst-case error. 

Let fin denote the distribution obtained by taking an equal mixture of the sole "no" instance and the 
uniform distribution over "yes" instances of Unique Search„. 

Theorem 1.1. Let n be an even positive integer. Let A be an algorithm (classical or quantum) that 
solves Permutation„ with distributional error at most s < 1/2 on the uniform distribution over per- 
mutations on [n], with q queries to the permutation oracle. Then there is an algorithm of the same kind as A 
(classical or quantum) with distributional error at most (1 + 2e)/4 with respect to the distribution /i„/2, that 
solves Unique Search„/2 with at most q queries to the search oracle in the classical case, and at most 2q 
queries in the quantum case. Moreover, this may be modified to an algorithm for Unique Search„/2 with 
worst-case error at most ^^2 < 1/-^ '^'^'^ with the same query complexity. 

We emphasize that the reduction uses only the knowledge of a bound e on the distributional error of A, 
and not its precise value. An algorithm for Permutation„ for n > 2 with distributional error at most e 
on the uniform distribution may be used to solve Permutation„_i with the same query complexity and 
distributional error at most e + l/2n on the uniform distribution (see the discussion after Lemma [2.21) . So 
a reduction similar to the one in the theorem above exists for odd n as well. 

Any quantum algorithm for Unique Search„/2 with constant probability of error < 1/2 with respect 
to fin/2 requires Q,{^/n) queries [2]. Theorem 11.11 therefore implies a similar lower bound for quantum 
algorithms for Permutation„, and an J7(n) query lower bound for classical algorithms for the problem. 
(The lower bound of il.{n) for Permutation„ in the classical case is straightforward to prove directly.) 

Corollary 1.2. Any quantum algorithm that solves Permutation„ (for any integer n > 1) with constant 
distributional error e < 1/2 on the uniform distribution over permutations on [n] requires ^(^/n) queries. 
Consequently, the same query lower bound holds for algorithms for Permutation„ with worst-case error at 
most e. 



Naturally, Theorem 11.11 and Corollarv ll.2l both also hold for any quantum algorithm for the search version 
of Permutation„ with the same kind of error bound as in the statements above. 

The reduction we present bypasses the hybrid argument due to Bennett, Bernstein, Brassard, and Vazi- 
rani [2] and the quantum adversary method due to Ambainis [T], and shows a direct connection between 
inversion and search. The hybrid argument underlying the reduction was discovered in 2004 and communi- 
cated informally to a few people. The reduction is written up here for wider dissemination. 

2 The reduction 

We start by fixing some notation and making preliminary observations. Then we sketch a hybrid argu- 
ment which paves the way for the reduction (Theorem 12. ip . Lemma 12.21 derives a worst-case algorithm for 
Unique Search„ from an average-case algorithm, and together with Theorem 12 . 1 1 implies Theorem ll.il We 
finish by sketching how Theorem 11.11 extends to odd n. 



Let n be any positive integer. Define the following sets of "no" and "yes" instances of Permutation„: 

Pq = Itt : TT is a permutation on [n], tt^ (1) is odd } , and 
Pi = {tt : TT is a permutation on [n], tt^ (1) is even | . 

We also consider oracles that compute functions /i : [n] — > [n] with a unique collision at 1, with one odd and 
one even number in the colliding pair. In other words, these functions h are such that there are precisely 
two distinct elements i,j with the same image under h. Moreover, h{i) = h{j) = 1, and precisely one of i,j 
is odd (and the other is even). Let Q denote the set of all such functions. 

Consider any fixed permutation tt on [n] . Consider also the functions in Q that differ from tt in exactly one 
point. These are functions h with a unique collision such that the collision is at 1, and |7r~^(l)n/i^^(l)|=l. 
If TT G Pqj then the even element that is also mapped to 1 by /i is precisely the one on which tt and h differ. 
Similarly, if tt G Pi , then the odd element that is also mapped to 1 by /i is precisely the one on which tt 
and h differ. Let Q^ denote the set of such functions h. If we pick a uniformly random permutation tt € Pq, 
and then pick a uniformly random function h in Q^r, then h is uniformly random in Q. The same holds if 
we switch Pq with Pi. 

Given a permutation tt on [n] with n even, and a function / : [n/2] — > {0, 1}, we define a function h^^j : 
[n] — > [n] as follows. If tt G Pq, for any i G [n], 

\l if i is even and /(i/2) = 1 

1 7r(i) if (i is odd) or {i is even and /(V^) = 0). 

If TT G Pi, for any i E [n], 

^^ ^^^ ^ U if (z is odd) and /((* + l)/2) = 1 ^^^ 

[7r(i) if (i is even) or (i is odd and /((« + l)/2) = 0). 

The function h^^j coincides with tt if /^^(l) is empty and belongs to Qtt otherwise. 

We make use of the above properties of Pq, Pi, Q, Qt^ and /i^j in our reduction. 

The essential idea behind our reduction is that any algorithm that distinguishes a uniformly random 
permutation in Pq from a uniformly random one in Pi necessarily distinguishes a random permutation from Pj 
from a uniformly random unique-collision function in Q, for at least one i G {0, 1}. Suppose that i = 0. 
Using convexity, we may further deduce that such an algorithm also distinguishes the permutation tt G Pq 
from a uniformly random unique-collision function h G Qtt, for at least one tt. Since any function h G Qjr 
differs from tt in exactly one of n/2 points when n is even, this final problem is equivalent to the problem 
of unique unordered search over a domain of size n/2. The above hybrid argument suffices to prove a query 
lower bound for Permutation„, but is not entirely satisfactory because it corresponds to a non- uniform 
reduction. (A priori, we do not know which i G {0, 1} and which tt € Pi would give us a correct algorithm 
for Unique Search„/2-) We may however glean a reduction in the uniform sense from this argument. The 
idea is to replace the choices made on the basis of existential arguments by randomized ones. We therefore 
try distinguishing a uniformly random tt G Pq from a uniformly random /i^j G Q^r, and similarly with a 
uniformly random permutation from Pi , with equal probability. At least one of these probabilistic attempts 
succeeds, and gives us a bounded-error algorithm. 

Recall that /i„ is the distribution which assigns probability 1/2 to the constant function 0, and probabil- 
ity l/2n to each of the "yes" instances of Unique Search„. Let /i^ be the uniform distribution on "yes" 
instances alone, and let /x" be the analogue for the lone "no" instance. 

Theorem 2.1. Let n be an even positive integer. Let A he an algorithm (classical or quantum) that 
solves Permutation„ with distributional error at most e < 1/2 on the uniform distribution over per- 
mutations on [n], with q queries to the permutation oracle. Then there is an algorithm of the same kind 
as A with distributional error at most ^ '^ < 1/2 with respect to fJ.n/2 that solves Unique Search„ /2 with 
at most q queries to the search oracle in the classical case, and at most 2q queries in the quantum case. 
Moreover, its error probability on an input drawn from fJ.'^i2 is at most e and that for M^ /j *■* '^1'^- 



Proof. Suppose we are given an algorithm A as in the statement of the theorem that takes as input an even 
integer n > 1, and an oracle 5 : [n] — >■ [n]. Let / be an input oracle for Unique Search„/2- Recall the 
definition of the function h^^j : [n] — >■ [n], where tt is a permutation on [n], as in Eqs. (|ll2p . The following 
reduction B solves Unique Search„ /2 with distributional error as claimed: 

With probability i, pick a uniformly random permutation tt £ Pq, output A{n, Httj) and stop. 
With probability ^, pick a uniformly random permutation tt e Pi, output -^A{n, h.^j) and stop. 

We may calculate the probability of error of the algorithm B by considering "yes" and "no" instances 
separately. The output of B on the lone "no" instance of Unique SEARCH„y2 is 

{A{n, tt) with probability ^, for a uniformly random tt £ Pq, and 
-^A{n,TT) with probability ^, for a uniformly random tt E Pi. 

Let Eq be the probability of error of ,4 on a uniformly random oracle from Pq, and let ei be the corresponding 
quantity for Pi. We have eo + ^1 ^ 2e. The probability of error of B on the "no" instance is thus bounded 
by (eo + £i)/2<£. 

The output of S on a uniformly random "yes" instance of Unique Search„/2 is 

{A{n,h) with probability ^, for a uniformly random h G Q, and 
^A{n, h) with probability ^, for a uniformly random h E Q. 

If p denotes the probability that the output A{n,h) is "no" for a uniformly random hE Q, the probability 
of error of i3 on a uniformly random "yes" instance of Unique Search„/2 is p/2 + (1 — p)/2 = 1/2. 

Since tt is known explicitly in the algorithm B, the function /i^ j can be evaluated with at most one query 
to / in the classical case. In the quantum case, the situation is not as straightforward. Data in quantum 
memory generated during computations may prevent the quantum interference necessary for correct working 
of an algorithm. This may be the case with the answers to oracle queries to / that are used to compute h^^j. 
It is therefore important to simulate queries to /i^j cleanly, i.e., without modifying any part of the workspace 
except the answer register. With a standard implementation of the oracle to / as a unitary operator, a query 
to /itt,/ can be simulated cleanly by using two queries (see [21 Section 4] or [H Section 1.5]). We note that by 
working with a different implementation of the oracle for /, it is possible to simulate a query to /i^r,/ cleanly 
with only one query. As this leads to only a minor improvement in our reduction, we omit the details. D 

Any algorithm with worst-case error e implies an algorithm with distributional error e with respect to any 
distribution. We point out that Unique Search and Permutation both admit random self-reductions, so 
the average-case algorithm described in Theorem l2 . 1 l implies the worst-case algorithm claimed in Theorem ll.il 

Lemma 2.2. Suppose B is an algorithm for UNIQUE Search„ with distributional error at most Si on 
distribution ^\, and at most Sq on /i^ such that eo+£i < 1. Then, there is an algorithm for Unique Search„ 
that makes the same number of queries as B, and has worst-case error at most 

max{£o,ei} 1 

l + |£o-ei| '^ 2 ■ 

Proof. Composing a function / : [n] — > {0, 1} with a permutation a on [n] preserves the "yes" and the "no" 
instances of Unique Search„. Consider the algorithm Bsym- 

Pick a uniformly random permutation a on [n] , and then return the value given by the algorithm B 
with every oracle query i E [n] replaced by a query to cr(i). 

Effectively, any single instance of Unique Search„ is mapped to a uniformly random instance with the 
same answer. So the worst-case error on the "no" instance is at most Eg, and on any "yes" instance is at 
most £1. 

It only remains to equalize the bounds on error on the two kinds of instance, and this may be accomplished 
by a standard modification: depending on whether £0 < £1 or not, we accept or reject with some probability p, 
and run the algorithm Bsym with probability I — p. The choice of p := |£i — £o| /(I + \ei — £o|) gives us the 
claimed error bound. D 



There is a similar randomized self-reduction for Permutation„. Let w, a be uniformly random permu- 
tations on [n] such that u maps 1 to itself, and a permutes odd integers among themselves and even integers 
among themselves. Then for any permutation tt on [n], the composition w o tt o cr is uniformly distributed 
in Pi if TT is a "yes" instance, and in Pq if it is a "no" instance. Therefore, an algorithm A for Permutation„ 
with distributional error at most ei,£o on uniformly random "yes" and "no" instances, respectively, leads 
to a worst-case algorithm which makes error at most ei on any "yes" instance and at most Eq on any "no" 
instance. When n is even, the distributional error of A on the uniform distribution is at most e — (eo +ei)/2 
and when n is odd, it is at most e = ((1 -I- l/n)eo -I- (1 — l/n)ei)/2. We may now rebalance the bound on 
error in the two kinds of instance to obtain a worst-case algorithm. The self-reduction also allows us to use 
an algorithm A for Permutation„ to solve Permutation„_i as claimed in Section[TJ We first symmetrize 
the algorithm A through the self-reduction, and then run it on the extension of the input permutation tt 
on [n — 1] obtained by defining 7r(n) — n. 
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